The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the subprocess module in scripts/build_ownership_map.py, scripts/community_maintainers.py, and scripts/run_ownership_map.py to execute git log commands.
Evidence: Subprocess calls utilize list-based arguments rather than shell strings, which is a security best practice that prevents shell injection vulnerabilities.
Scope: These commands are central to the skill's primary purpose of analyzing repository history.
[INDIRECT_PROMPT_INJECTION]: The skill represents an ingestion surface for untrusted data by processing information from git repositories (filenames, author names, and email addresses).
Ingestion points: Git repository metadata parsed via git log (detected in scripts/build_ownership_map.py).
Boundary markers: The skill exports analyzed data into structured formats like CSV and JSON, which helps maintain data boundaries.
Capability inventory: File system write access for report generation and subprocess execution for git metadata retrieval.
Sanitization: Input from git is parsed into specific fields (e.g., author_email, path) before being used in analytical computations, reducing the risk of malicious payload execution.
[EXTERNAL_DOWNLOADS]: The skill documentation recommends using uv to provision networkx, a well-known and trusted Python library for graph analysis.
Evidence: uv run --with networkx is used to manage the dependency environment safely during runtime.

security-ownership-map